fix(secrets): include skill metadata references in usages, route, and delete dialog

secretsSvc.usages() previously only scanned agent env bindings. Skills can
reference a secret via metadata.sourceAuthSecretId (set by the PAT auth
feature), so removing a secret without checking those references could orphan
a sibling skill's PAT pointer.

- Extend usages() to return { agents, skills } with both reference kinds.
- Update remove() to block when either array is non-empty.
- /secrets/:id/usages now responds with { agents, skills }.
- The delete dialog displays both kinds inline so the operator knows which
  references to detach first.

server/src/routes/secrets.ts

@@ -141,8 +141,8 @@ export function secretRoutes(db: Db) {
       return;
     }
     assertCompanyAccess(req, existing.companyId);
-    const agents = await svc.usages(existing.companyId, id);
-    res.json({ agents });
+    const used = await svc.usages(existing.companyId, id);
+    res.json({ agents: used.agents, skills: used.skills });
   });
 
   router.delete("/secrets/:id", async (req, res) => {